Several systems and methods for redacting text from electronic documents are heretofore known. For example, a “Word 2007 Redaction Tool” by Microsoft Corporation of Redland, Wash. can be used to hide text within documents in Microsoft's Office Word document format. Users can mark text to redact and then create a new redacted version of the document in which the marked text is replaced with a black bar that cannot be converted back to the original text. The Word 2007 Redaction Tool works by allowing users to redact a document using a two stage process wherein regions of text which should be redacted are first marked within the document. Then, the marked document is redacted and all marked text is replaced.
A number of other systems provide similar capabilities. For example, both version 9.0 of Adobe Acrobat software by Adobe corporation of San Jose, Calif., as well as the prior version, include “Redaction Tools.” The Redaction tools allow permanent removal of visible text and images from files in Adobe Corporation's PDF format. In place of the removed items, redaction marks may appear as colored boxes may be implemented as a blank area. Custom text or redaction codes may be specified to appear over the redaction marks.
FIGS. 1A-1E illustrate the principles of the presently known redaction methods using as an example the aforementioned Acrobat product. FIG. 1A shows a typical application window or browser screen 101 containing an electronic document 102, in which the user presumably wishes to redact certain as yet unspecified text or images. Tools list 103 is opened by various means including, as shown in FIG. 1A, by clicking on “Advanced” and selecting the “Redaction” option from the toolbar in application window 101. In the case of Acrobat, clicking on the redaction tool for the first time opens dialogue box 104, which as shown describes the essential properties of the tool. As noted, the dialogue box description includes warning 105 that underscores the aforementioned permanent nature of the redaction in the present state of the art by reminding the user that she will be prompted to rename the document after she applies the redactions in order to have one copy without redaction and another copy with redactions applied.
Continuing the illustration of previously known redaction tools with FIG. 1B, clicking on the Search option 106 opens a window where the user may search the text of the document to find a particular word or phrase, and which in turn opens Search results window 107. FIG. 1B shows the search results returned in this example when, as explained by notice 108, looking for the phrase “portions of the document”. As illustrated by notice 109, this search results in a total of 3 instances in the example, and dialogue box 110 immediately below identifies each of these instances in the present document. Check boxes 111(a) through 111(c), corresponding to highlighted text fields 112(a) through 112(c), respectively, permit the user to select (by the check mark shown) or deselect (by un-checking the corresponding box) each of the times the phrase appears within the document that should be redacted. Once the user is happy with these selections, clicking on button 113 has the effect of marking the checked results for redaction.
FIG. 1C illustrates that in the case of Acrobat, this opens the “Redaction Properties” item 114 on tool list 103, and the corresponding “Redaction Tool Properties” dialogue box 115. As shown therein, the user is permitted to specify the desired properties for the redacted area. Thus, where as indicated above some examples of the present state of the art always return blackened fields, Acrobat permits the user to select a number of options including but not necessarily limited to area fill color 116(a); font 116(b); text color 116(c); and custom text 116(d) to appear within the redacted area. Once the user is comfortable with these settings, she clicks on the acceptance button 117, which will affect areas 118(a) to 118(c) (corresponding to areas 112(a) to 112(c) of FIG. 1B).
Continuing the illustration of previously known redaction tools with FIG. 1-D, clicking on link 119 allows the user to search for additional words and/or phrases in the document, and to repeat the foregoing process. FIG. 1-D shows, for example, the additional search results returned when, as explained by notice 120, looking for the phrase “portions of that document” (contrast with “portions of the document” in case of notice 108 of FIG. 1B), returns one additional instance 121, corresponding to marked text field 122. Once the user is satisfied that all of the desired portions of the document have been identified, she may click on the “Apply Redactions” item 123 on tool list 103. As shown, this action opens the warning dialogue box 124, reminding the user that this will permanently redact all of the marked areas and that once the document has been saved, the operation cannot be undone.
FIG. 1E shows the result of proceeding, which is accomplished by the user clicking on the “OK” button (in dialogue box 124 of FIG. 1D). As shown in this illustration, application window or browser screen 101 now contains a redacted version 125 of electronic document 102 of FIG. 1A, and incorporates the redaction properties specified in dialogue box 115 of FIG. 1C. As shown therein, redaction labels 126(a) through 126(c) now appear, respectively, in place of marked text fields 118(a) to 118(c) shown on FIG. 1C; and redaction label 126(d) now appears in place of marked text field 122 shown on FIG. 1D.
The redacted document 125 has the advantage of being permanently changed, thereby making it impossible for a recipient to recover the original text of the predecessor electronic document 102. This attribute of the redacted portions of the original electronic document being impossible for a recipient to recover has a number of applications, including without limitation in a legal, regulatory and agency context.
For example, ethics rules require attorneys to zealously guard the confidentiality of clients. Violations of this responsibility may result in civil and, in some instances, criminal penalties. Further, contractual obligations may be imposed on the recipient of confidential information. Violations of the contractual obligations may result in substantial damages. Government agencies and administrative departments also have a responsibility to protect state secrets in declassified documents. Additionally, a variety of state and federal regulatory requirements prevent disclosure of confidential information.
One such regulatory context is in the healthcare field. For example, the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and recently enacted Health Information Technology for Economic and Clinical Health (HITECH) provisions of the American Recovery and Reinvestment Act (ARRA) obligate holders of confidential medical information to prevent disclosure of certain personally-identifiable information and other confidential information without the express authorization of the subject (e.g., the patient).
The inability of a recipient to recover redacted information in electronic documents that had been redacted using heretofore known redaction systems and methods presents a number of disadvantages. For example, certain obligations of confidentiality are often limited by a time period, after which the previously confidential portions of such documents are no longer subject to such restrictions. In another example, it may become useful for the party who originally imposed the confidentiality obligations to relieve some or all of the recipients of some portion or all of such limitations. This is particularly apparent in the case of confidential health information where, for example, a patient may indicate that all of their records be kept confidential but may elect to grant rights to selected parties such as medical specialists or care-takers to have access to some portion or all of such information for the period during which the patient is in such person's care.
In each of such examples, it would be preferable if the individual entitled to impose such confidentiality requirements were able to control access to their respective confidential data by defining data attributes thereto.